CCNA Practice Test 20 — 15 Questions

Question 1

Drag and drop the items on the left to match the descriptions on the right.

Accepted Answer

switchport mode trunk: Configures a trunk port. VLANs segment a switch into multiple broadcast domains. 802.1Q trunking encapsulates frames with a VLAN tag, while the native VLAN carries untagged traffic. 'switchport mode trunk' configures a trunk port, 'show vlan brief' lists VLAN assignments, and inter-VLAN routing enables communication between VLANs typically using a router or Layer 3 switch.

Answer

VLAN: Encapsulates frames with a VLAN tag

Answer

802.1Q trunking: Carries untagged traffic on a trunk

Answer

Native VLAN: Segments a switch into multiple broadcast domains

Question 2

An EtherChannel between SW1 and SW2 is not forming. The technician runs the show etherchannel summary command on both switches and sees that all configured interfaces are in the 'I' (stand-alone) state. Both switches have their interfaces configured with channel-group 1 mode active. What should the technician check next?

Accepted Answer

Check for a VLAN mismatch on the member interfaces (e.g., mismatched native VLAN or allowed VLAN list).. When both switches are configured with channel-group 1 mode active, they are using LACP (active/active). The 'I' (stand-alone) state indicates the ports are not forming an EtherChannel despite LACP being enabled. A VLAN mismatch—such as differing native VLANs or allowed VLAN lists—can prevent LACP from successfully negotiating the bundle, as the control plane sees a Layer 2 inconsistency and keeps the ports in stand-alone mode.

Answer

Verify that both switches are using the same EtherChannel protocol (LACP or PAgP).

Answer

Check that the speed and duplex settings match on all member interfaces.

Answer

Determine whether Spanning Tree Protocol is blocking one of the ports.

Question 3

Which four of the following are true statements regarding the operation of DHCP snooping on a Cisco switch? (Choose all that apply. There are four correct answers.)

Accepted Answer

DHCP snooping builds and maintains a DHCP snooping binding database (also called a binding table).. The four correct statements are true because DHCP snooping is a security feature that operates by classifying switch ports as trusted or untrusted. By default, all ports are untrusted, meaning they cannot send DHCP server messages (OFFER, ACK, NAK) unless explicitly configured as trusted. Rate-limiting DHCP messages on untrusted ports mitigates DHCP starvation attacks, and the binding database (MAC-to-IP mapping) is built from DHCP ACK messages to prevent IP spoofing. The incorrect statement "DHCP snooping requires an external DHCP server to be configured on the switch" is false because DHCP snooping itself does not require the switch to act as a DHCP server; it simply relies on DHCP messages from a legitimate server reachable through a trusted port.

Answer

DHCP snooping prevents rogue DHCP servers by allowing only authorized servers on any port.

Answer

DHCP snooping requires an external DHCP server to be configured on the switch.

Question 4

Which three of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose three.)

Accepted Answer

By default, all ports on a Cisco switch are in VLAN 1.. The correct statements are: (1) The 'switchport mode access' command places the interface into a non-trunking mode; (2) By default, all ports on a Cisco switch are in VLAN 1; (3) The 'show vlan brief' command displays VLANs that are active on the switch. The remaining statements are false because: VLANs 1002–1005 are reserved for legacy FDDI/Token Ring VLANs, not for user-created VLANs; a VLAN does not need to be manually created before its name can be assigned (assigning a port to a new VLAN can automatically create it, after which you can set its name); and the 'switchport trunk native vlan' command does not restrict the native VLAN to only tagged frames—native VLAN traffic is sent untagged.

Answer

The 'switchport trunk native vlan' command restricts the native VLAN to only tagged frames.

Answer

VLANs 1002–1005 are reserved for user-created VLANs.

Answer

A VLAN must be manually created before its name can be assigned.

Question 5

Why is idempotency valuable in network automation?

Accepted Answer

It ensures repeated runs converge on the same desired state safely.. Idempotent operations can be applied repeatedly without causing unintended changes once the desired state is already present.

Answer

It guarantees every API call will use TCP instead of UDP.

Answer

It encrypts device credentials stored in scripts.

Answer

It forces the controller to use only one management protocol.

Question 6

Which three options best describe how machine learning models are trained for network anomaly detection? (Choose three.)

Accepted Answer

Using historical baseline traffic data to learn normal behavior patterns. Machine learning models for network anomaly detection are effectively trained using historical baseline traffic data to learn normal behavior patterns, which allows the model to identify deviations that may indicate anomalies. Labeled datasets with known attack signatures enable supervised learning, where the model learns to classify traffic as normal or malicious based on examples. Unsupervised clustering techniques, such as k-means or DBSCAN, can identify deviations without predefined labels by grouping similar data points and flagging outliers as potential anomalies. The three incorrect options—manual threshold configuration, training exclusively on synthetic data, and reliance on SNMP polling—are not characteristic of ML training methods. Manual threshold configuration is a rule‑based approach that does not involve learning from data. Training exclusively on synthetic data is not representative of real‑world traffic patterns and would not generalize well. Relying solely on SNMP polling intervals is a traditional monitoring method, not a machine learning technique.

Answer

Relying solely on SNMP polling intervals to detect anomalies

Answer

Requiring manual threshold configuration for every monitored metric

Answer

Training exclusively on synthetic data generated by simulation tools

Question 7

Which three of the following are characteristics of DHCP snooping? (Choose three.)

Accepted Answer

It builds and maintains a DHCP snooping binding database.. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database to track valid IP-to-MAC address assignments. It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, and it validates DHCP client MAC addresses against the source MAC in the Ethernet frame to prevent MAC spoofing. These three functions directly correspond to the correct answer options.

Answer

It automatically enables IP source guard when configured globally.

Answer

It allows DHCP server messages from untrusted ports if the source MAC matches.

Answer

It filters untrusted DHCP messages on trusted ports.

Question 8

Which three of the following are correct steps in the process of CDP (Cisco Discovery Protocol) neighbor discovery? (Choose three.)

Accepted Answer

CDP is enabled by default on Cisco devices and runs over all interfaces that support SNAP headers.. CDP is a Cisco proprietary Layer 2 protocol that uses multicast MAC address 01:00:0C:CC:CC:CC to send advertisements to directly connected neighbors. Advertisements include device identifier, platform, and capabilities. CDP is enabled by default on Cisco devices and runs over interfaces supporting SNAP headers. Incorrect options: CDP advertisements are sent every 60 seconds by default (not 30); CDP discovers only directly connected neighbors (not devices more than one L2 hop away); CDP does not require both devices to be in the same IP subnet because it operates at Layer 2.

Answer

CDP advertisements are sent every 30 seconds by default.

Answer

CDP requires that both devices be in the same IP subnet.

Answer

CDP can discover devices that are more than one Layer 2 hop away.

Question 9

Which two statements accurately describe the purpose of least privilege in administration and operations?

Accepted Answer

It limits users and administrators to the permissions they actually need.. Least privilege is about limiting access to what is actually needed. In practical terms, it reduces unnecessary exposure and helps contain the impact of mistakes, misuse, or compromised accounts. It is not about refusing all access. It is about granting enough access to do the job, but not more than that.

This is a central principle in secure administration and role design.

Answer

It means no administrator should ever have any configuration access.

Answer

It replaces the need for logging and accounting.

Answer

It exists only on wireless guest networks.

Question 10

Which three of the following statements about the routing table lookup process on a Cisco router are true? (Choose three.)

Accepted Answer

The router performs a longest prefix match to select the most specific route for a destination IP.. The routing table uses longest prefix match (A) to find the most specific route. The default route (C) is used only when no other route matches. Directly connected routes (F) are automatically installed when the interface is up/up. Option D is incorrect because the router does recursively resolve the next‑hop IP when it is not directly connected.

Answer

If an exact match is found for the destination network, the router will forward the packet regardless of any more specific routes.

Answer

The router does not perform recursive resolution when the next-hop IP address is not directly connected.

Answer

The router always prefers routes with a higher administrative distance over those with a lower administrative distance.

Question 11

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

Accepted Answer

The NAT statement is missing the overload keyword. Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.

Answer

The access list should deny the inside subnet

Answer

The inside and outside interface roles are reversed in the exhibit

Answer

NAT cannot be used with RFC1918 addresses

Question 12

Drag and drop the following steps into the correct order to configure Router R1 with OSPFv2 process 1 to form neighbor adjacencies only on GigabitEthernet0/1 while preventing OSPF hello packets on all other OSPF-enabled interfaces.

Accepted Answer

router ospf 1. First, enter OSPF router configuration mode. Then assign a Router ID (optional but good practice). Next, advertise the local subnet with a network statement to enable OSPF on interfaces. Then apply passive-interface default to suppress hellos on all OSPF interfaces. Finally, use no passive-interface to allow adjacency on the specific interface.

Question 13

Drag and drop the following steps into the correct order to configure a Cisco switch access port with a data VLAN and a voice VLAN.

Accepted Answer

Enter global configuration mode (configure terminal). First, enter global configuration mode with 'configure terminal'. Next, select the interface using 'interface GigabitEthernet0/1'. Then, set the port to access mode with 'switchport mode access' to prevent trunk negotiation. After that, assign the data VLAN with 'switchport access vlan 10'. Finally, assign the voice VLAN with 'switchport voice vlan 20'. This order ensures the interface is properly configured before VLAN assignment and prevents DTP from creating a trunk.

Question 14

Drag and drop the protocol/model on the left to the correct description on the right.

Accepted Answer

YANG: Data modeling language used to define configuration and state data structures. YANG is a data modeling language used to define configuration and state data. NETCONF is an XML-based protocol over SSH that supports transactional configuration management. RESTCONF is a RESTful API over HTTPS that uses standard HTTP methods like GET, PUT, POST, DELETE. NETCONF <edit-config> is an operation that modifies configuration with options like merge, replace, create, delete. RESTCONF PATCH is an HTTP method used for partial updates to a resource.

Question 15

Drag and drop the following steps into the correct order to troubleshoot a client PC that cannot connect to a remote web server.

Accepted Answer

Run ipconfig /all to verify the PC's IP address, subnet mask, and default gateway.. The correct order follows Cisco's bottom-up troubleshooting methodology: first verify local IP configuration with ipconfig, then confirm the local TCP/IP stack with a loopback ping, then verify the NIC and IP binding by pinging the assigned address. Next, test connectivity to the default gateway to ensure the local subnet and router are reachable. After that, attempt to reach the remote server's IP address with ping. If that fails, use traceroute to identify where along the path the packets are lost. This sequence efficiently isolates the fault domain from the local device to the internetwork.